Basically, I am trying to sniff the network traffic from my other computer. So here's the situation:
I am in a network, where:
192.168.1.1 - default gateway 192.168.1.24 - "victim" (my other computer) 192.168.1.20 - "attacker"
I am using
bettercap, but I actually tried
ettercap before. Steps to reproduce:
echo 1 > /proc/sys/net/ipv4/ip_forward bettercap -i wlan0 > arp.spoof targets 192.168.1.24 > arp.spoof on
Then I can check that it works by actually pinging
192.168.1.20, the attacker IP, and it responds rapidly quick, so I actually ping the default gateway. I guess that's how it works, right?
Then I run some sniffing. Tried multiple tools:
urlsnarf - doesn't show anything. It can actually show the localhost traffic (done from the attacker pc) dsniff - same as above tshark/wireshark - They are showing some udp/tcp packets, but still no http ones (f.e entering a website, POSTing in a fake user/pass form) bettercaps net.sniff - actually pretty much the same as tshark/wireshark
I uncommented those 2
iptables lines from
ettercap.conf, when I was using
ettercap (btw, I was doing:
ettercap -Tqi wlan0 -M arp (or arp:remote) // //
So my question here is: Is there something wrong with my spoofing, or do I need to sniff somehow different?
P.S I tried those things on both
P.S 2 I actually tried bettercaps
dns.spoof and it also works only on the "attacker" pc, when I ping or go to some website on my "victim" machine, everything works fine - so not fine, cuz it should redirect